refactor(core): simplify file tools to lexical paths - #40962

What

Simplify the V2 file tools to match V1 and established agent-tool behavior:

• resolve mutation paths lexically instead of canonicalizing through symlinks
• list symlinks as unresolved directory entries, including broken and escaping links
• decode malformed UTF-8 lossily with U+FFFD
• detect binary files from content instead of extension blocklists

How

• LocationMutation now uses path.resolve(location.directory, input.path) as its single absolute filesystem path and retains the existing lexical external_directory authorization flow.
• Removed the ancestor walk, realpath canonicalization, and non_directory_ancestor error. Filesystem operations now report ordinary OS errors for invalid ancestors.
• ReadToolFileSystem.list uses readDirectoryEntries types directly, preserves directory separators, and emits a tool-local symlink entry type without following or filtering links.
• Text reads use lossy TextDecoder behavior while preserving null-byte/non-printable binary sniffing, media magic-byte handling, base64 ingestion, and media size limits.
• Removed the binary extension set and both extension checks.

This follows V1 parity and the direction established by #38180, where external authorization became lexical. Cloudflare realpath PR #7515 was rejected because symlinks outside the working directory are permitted. The field survey across Codex, Gemini, OpenHands, Claude Code, pi-mono, and flue found no agent that escape-filters listed symlinks or hard-fails malformed UTF-8.

Scope

This PR deliberately does not change the streaming read state machine, FileMutation BOM/locking/formatter behavior, AGENTS.md discovery, environment drivers, or process spawning.

Testing

• packages/core: bun typecheck
• packages/core: bun run test (1,551 pass, 7 skip; only the known global-config leakage failure in config/plugin.test.ts)
• packages/server: bun typecheck
• packages/protocol: bun typecheck
• packages/cli: bun typecheck
• packages/util: bun typecheck
• packages/schema: bun typecheck
• packages/client: bun typecheck
• pre-push workspace typecheck: 32/32 packages passed
• focused changed behavior: 117/117 Core file-tool tests passed